philippe's questions

I need to get iptables rules from a Linux Debian server. i know about iptables -L -n -v command for instance but as the server may be compromised i can't rely on local commands which may be corrupted. Instead, I need in my binary to load utilities statically compiled in order to get a fingerprint of the server without using local commands.

Most thinks can be retrieved from /proc pseudo filesystem. However, nothing seems to be accessible regarding iptables configuration.

Is it possible to get iptables rules without using iptables related commands ?

I am trying to create a vmware virtual machine from a physical one running RedHat. Here are the steps I followed:

I create a VM and boot a live-cd (kali). I perform a rsync of the physical host for its / without the proc, sys and dev folders. I launch the VM, starting on kali, and partition /dev/sda to get a /dev/sda1. I create a ext4 filesystem on it and mount it on /mnt.

I recreate the /dev, /proc and /sys folders:

mount -t proc proc /mnt/proc
mount -t sysfs sys /mnt/sys
mount -o bind /dev /mnt/dev

I edit /etc/fstab:

/dev/sda1 / defaults 0 0

I chroot into /mnt:

chroot /mnt /bin/bash

I install grub, recreate an initrd, and the grub configuration file: ($(uname -r) launched on physical server)

grub2-install --recheck --no-floppy /dev/sda
mkinitrd /boot/initrd.$(uname -r).img $(uname -r)
grub2-mkconfig -o /boot/grub2/grub.cfg

I reboot ;

grub menu is loaded, I can choose system to get loaded, when I try rescue mode, I can reach the login interface ; the appropriate hostname get shown on my VM:

physical_hostname login:

However, I can't login (I am pretty sure having entered the appropriate password)

If I don't chose the rescue mode, the system does not fully boots: Here are the last lines printed:

[ OK ] Started show plymount boot screen
[ OK ] Reach target paths
[ OK ] Reach target basic system
... Here, I wait for like 2 minutes
dracut-initqueue[246]: Warning: dracut-initqueue timeout - starting timeout scripts
... This message gets prints like 100 times
[ OK ] Started dracut initqueue hook
[ OK ] Reached target Remote File Systems (Pre).
[ OK ] Reached target Remote File Systems.
dracut-initqueue[246]: Warning: dracut-initqueue timeout - starting timeout scripts
A start job is running for dev-disk...225a.device

And it does not stop.

I'm pretty sure I close to boot my system; however I am totally stuck. Many thanks for helping ; I'm feeling pretty desperate

I am trying to setup unprivileged LXC containers as explained in Debian Wiki on a Jessie Debian physical server (4.9.135 kernel). Hence, I want to enable the userns namespace:

sysctl kernel.unprivileged_userns_clone=1
sysctl: cannot stat /proc/sys/kernel/unprivileged_userns_clone: No such file or directory

However, this kernel has been compiled with the user namespace support, as shown in:

zgrep CONFIG_USER /proc/config.gz 
CONFIG_USER_NS=y

I have run lxc-checkconfig which shows enabled for every items except checkpoint restore: missing which does not seem to be user namespace related:

--- Namespaces ---
User namespace: enabled
--- Checkpoint/Restore ---
checkpoint restore: missing

Googling around does not help much understanding this error... Can anyone help me solving this issue? Do not hesitate to ask for any information which may be missing...

I'm trying to setup a IPSec tunnel between two LXC Debian Jessie on the same physical server (Debian as well). Here is my network topology :

172.17.23.0/24 ---- 172.17.23.100 - VPN1 - 10.73.52.1 ==== 10.73.53.2 - VPN2 - 192.168.100.100 ---- 192.168.100.0/24

The configuration on VPN1 and VPN2 is the same, I'm authenticating with Pre-Shared-Key :

/etc/ipsec.conf config setup charondebug="all" uniqueids=yes

conn %default

conn testconn
  left=10.73.53.1
  leftsubnet=172.17.23.0/24
  right=10.73.53.2
  rightsubnet=192.168.100.0/24
  ike=aes128-sha1-modp1024
  esp=aes128-sha1
  keyingtries=0
  ikelifetime=60m
  auto=start
  closeaction=restart
  keylife=20m
  rekeymargin=3m
  keyexchange=ike
  mobike=no
  authby=secret
  type=tunnel

/etc/ipsec.secrets 10.73.53.1 10.73.53.2 : PSK "PasswordHere"

I startup both sides ipsec start and up text connection ipsec up

root@vpn1:~# ipsec up testconn
initiating IKE_SA testconn[3] to 10.73.53.2
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
sending packet: from 10.73.53.1[500] to 10.73.53.2[500] (304 bytes)
received packet: from 10.73.53.2[500] to 10.73.53.1[500] (36 bytes)
parsed IKE_SA_INIT response 0 [ N(NO_PROP) ]
received NO_PROPOSAL_CHOSEN notify error
establishing connection 'testconn' failed
Idem pour vpn2.

I got similar messages in syslog.

I don't understand why I get this NO_PROPOSAL_CHOSEN, as I'm trying to force the choice of algorithms to be used in the /etc/ipsec.conf file !

Many thanks for your help, don't hesitate to ask for more informations.

EDIT : Here is extract from /var/log/syslog from VPN2 (receiving connection) :

vpn2 charon: 07[NET] sending packet: from 10.73.53.2[500] to 10.73.53.1[500] (940 bytes)
vpn2 charon: 09[NET] received packet: from 10.73.53.1[500] to 10.73.53.2[500] (36 bytes)
vpn2 charon: 09[ENC] parsed IKE_SA_INIT response 0 [ N(NO_PROP) ]
vpn2 charon: 09[IKE] received NO_PROPOSAL_CHOSEN notify error
vpn2 charon: 10[NET] received packet: from 10.73.53.254[500] to 10.73.53.2[500] (940 bytes)
vpn2 charon: 10[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
vpn2 charon: 10[IKE] no IKE config found for 10.73.53.2...10.73.53.254, sending NO_PROPOSAL_CHOSEN

I got this no IKE config found, googling does not help much :/

EDIT2 : Here is the output of ipsec statusall :

root@vpn1:~# ipsec statusall
Status of IKE charon daemon (strongSwan 5.2.1, Linux 3.16.0-4-amd64, x86_64):
  uptime: 46 minutes, since Dec 15 14:56:02 2017
  malloc: sbrk 2408448, mmap 0, used 310128, free 2098320
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 0
  loaded plugins: charon aes rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default stroke updown
Listening IP addresses:
  172.17.23.10
  10.73.53.1
Connections:
    test:  10.73.53.1...10.73.53.2  IKEv1/2
    test:   local:  [10.73.53.1] uses pre-shared key authentication
    test:   remote: [10.73.53.2] uses pre-shared key authentication
    test:   child:  172.17.23.0/24 === 192.168.100.0/24 TUNNEL
Security Associations (0 up, 0 connecting):
  none
root@vpn1:~# 

I have exactly the same on server VPN2 (except 172.17.23.0/24 is changed for 192.168.100.0/24, which is local subnet on VPN2 side).

I can successfully connect and search to an Active Directory domain controller using ldapsearch. I am using the -x option, to specify a username/password authentication (password being specified by -W and username by -D).

I currently need to dump directory from a MIT-kerberos domain. Kerberos is the only protocol available for authentication. I can retrieve a kerberos TGT ticket with kinit. I am using these command lines:

ldapsearch  -Y SASL -b "REALM.INC" -H ldap://kerberos_IP_address
-> ldap_sasl_interactive_bind_s: Unknown authentication method (-6)
  additional info: SASL(-4): no mechanism available: No worthy mechs found

ldapsearch -o "mech=GSSAPI" ...
-> Invalid general option name: mech

How can I authenticate with kerberos using ldapsearch?

Many thanks for your help&replies

I am trying to configure my dhcp server on Debian Wheezy to reply to DHCP INFORM and send a url where my Windows client may download the wpad.dat file.

Here is the configuration file:

option local-proxy-config code 252 = text;

subnet 192.168.1.0 netmask 255.255.255.0 {
  option domain-name-servers 192.168.1.1;
  option routers 192.168.1.1;
  option local-proxy-config "http://192.168.1.85/wpad.dat";
}

The client sends a DHCP INFORM and my DHCP server replies with a DHCP ACK:

Feb  7 16:40:07 server dhcpd: DHCPINFORM from 192.168.1.99 via eth0
Feb  7 16:40:07 server dhcpd: DHCPACK to 192.168.1.99 (78:92:9c:31:de:26) via eth0

However, no HTTP requests are made after the client gets the information about the location of the wpad.dat file.

The autoconfiguration option in Internet Explorer is correctly enabled, and I have reset cache/reinitialized IE configuration multiple times.

When I manually field in IE the location of the wpad file, it gets correctly downloaded, and wpad file gets correctly interpreted (CLient goes then through my proxy), which makes me think the trouble comes from the DHCP ACK not correctly interpreted by Windows.

I don't know how to investigate further, can anyone give me some tip / idea to solve this issue? Many thanks!

While reading nmap man pages, I read for the -sn option:

The default host discovery done with -sn consists of an ICMP echo request,
TCP SYN to port 443, TCP ACK to port 80, and an ICMP timestamp request
by default.

I don't understand well the purpose of performing a TCP ACK on port 80. Since the TCP stack of the targeted server would not process any SYN, it would just drop the received ACK packet, not providing any information to nmap.

For instance, on my private server, it replies to ICMP echo request by a ICMP echo reply, and to TCP SYN port 443 by a TCP SYN-ACK. But no answer are provided with a TCP ACK on port 80.

Many thanks for your lights on the mater

I am working on Lubuntu 14.04 LTS with LXDE Desktop Manager and I would like to change default Desktop icons layout. (These are shortcuts for some application).

By default, these icons are layered at the Top Left, and that is not what I want.

As I have dozens of box to configure, I was wondering whether a configuration file for this setting may exist. I can click and move icons where I want, but I am looking for an automatic setup. I would like for instance to move them at the Bottom Left.

I have been looking at ~/.config/libfm/*, ~/.config/openbox ...

Without any success.

Thanks for any tip

I would like to pass the environment variable REMOTE_USER set by apache when HTTP basic authentication is correct to a backend. This would provide authentication to the backend server as well.

Here is my apache2 configuration file:

<Directory />
  AuthType basic
  AuthUserFile $my_file
  require valid-user
  RewriteEngine on
  RewriteCond %{REMOTE_USER} (.+)
  RequestHeader set X-Forwarded-User %{REMOTE_USER}e
</Directory>

Authentication by apache2 goes well, as I am properly redirected to the backend server, but then, backend server does not receive the REMOTE_USER as the X-Forwarded-User variable does not appear in tcpdump trace.

What may I have forgotten/misconfigured which does not let this REMOTE_USER variable being forwarded to backend as X-Forwarded-User?

looks like quite common with uWSGI application, but still can't find any valuable solution.

I ma working on ubuntu 12.04 with uwsgi 1.0.3 and python2.7

Here is my config.ini file:

  [uwsgi]
  uid = www-data
  gid = www-data
  pythonpath = /path/to/my/application
  plugins = python27
  module = launcher.py
  workers = 2
  vacuum = True
  max-requests = 1000000
  harakiri = 120
  harakiri-verbose = true
  need-app = true
  buffer-size = 32768
  listen = 200
  master-as-root = true
  max-fd = 10240
  #memory-report = true
  #stats = /tmp/stats.socket
  chown-socket = www-data

All I got from the log files is:

  [uWSGI] getting INI configuration from /usr/share/uwsgi/conf/default.ini
  [uWSGI] getting INI configuration from /etc/uwsgi/apps-enabled/my_application.ini

I don't find any way to launch it manually (on foreground, without daemonizing; I have read the doc here but the option --wsgi-file to sepcify the configuration file does not work) or to increase the verbosity.

I have spend hours parsing google and the uwsgi doc to find my way out, any help would be greatly appreciated.

EDIT:

It looks like uwsgi is starting now, and loading the cherrypy application behind. But at this point, it crashes with the error message:

CherryPy Checker:
The Application mounted at '' has an empty config.

[06/May/2014:14:40:57] ENGINE Started monitor thread 'Autoreloader'.
[06/May/2014:14:40:57] ENGINE Started monitor thread '_TimeoutMonitor'.
[06/May/2014:14:40:57] ENGINE Serving on 127.0.0.1:8080
[06/May/2014:14:40:57] ENGINE Bus STARTED
WSGI app 0 (mountpoint='') ready in 1 seconds on interpreter 0x201c680 pid: 9890 (default app)
*** uWSGI is running in multiple interpreter mode ***
spawned uWSGI master process (pid: 9890)
spawned uWSGI worker 1 (pid: 9940, cores: 1)
spawned uWSGI worker 2 (pid: 9941, cores: 1)
metrics collector thread started
invalid signal timer syntax, must be: <signal> <seconds>
VACUUM: unix socket /run/uwsgi/app/uwsgi/socket removed.
root@test:/var/www/ce1sus# Tue May  6 14:40:57 2014 - uWSGI worker 1 screams: UAAAAAAH my master disconnected: i will kill myself !!!
Tue May  6 14:40:57 2014 - uWSGI worker 2 screams: UAAAAAAH my master disconnected: i will kill myself !!!

I run this command:

uwsgi my_application.ini

My uwsgi version is now 2.0.4;

Do I have missed some step somewhere? Many thanks for your help

I'm trying to access gitlab with my account in SSH with public key authentication. I have uploaded my public key and here is my SSH configuration:

content of /home/$my_user/.ssh/config
Host gitlab
User git
Port 22
Hostname gitlab.$my_domain
IdentityFile /home/$my_user/.ssh/id_rsa
IdentitiesOnly yes

Here is the command I tiped:

mkdir $my_project
cd $my_project
git init
touch README
git add README
git commit -m 'first commit'
git remote add origin gitlab:$my_user/$my_project.git
git push -u origin master

Here is the sshd log file: auth.log

Here is the stack on client side: client stack

As I am authenticated, and my key correctly loaded from ~git/.ssh/authorized_keys, I presume the trouble comes from the client side. But I cannot determine where the issue comes from and neither how to fix it.

Many thanks for your help; Don't hesitate to ask for more details if you need to.

EDIT: here is the output of ssh -v git@gitlab

we have discovered gitlab, and I would like to integrate it in our global authentication process, which relies on apache HTTP_REMOTE_USER environment variable.

I have seen very little documentation on it, so I am looking desperately for any help on how to do this. I would like to retrieve from the gitlab application the HTTP_REMOTE_USER variable and use it to authenticate my users.

I have tried to use omniauth and omniauth-ldap, but this returns only in Errors 500 in my server and seems to be a little bit overkill to only retrieve Apache HTTP_REMOTE_USER variable. What i am looking for is if such a feature simply exists, or if i am going to a wrong direction; if someone has some links to doc on it!

Many thanks

Many thanks for your answer! I had already add the RequestHeader in the apache configuration file (I am using as you apache as unicorn reverse proxy instead of nginx, and needed to forward the HTTP_REMOTE_USER to unicorn in the apache header). Then, I have applied the patch available here.

Unlike you, I am not using a ldap username/password authentication, but a kerberos authentication with ldap for autorisations. When I reach the gitlab web page, I can see on the logs that my authentification is granted, and gitlab retrieve from ldap my user attributes (email address). It even creates my account (as per allow_single_sign_on: true on /home/git/gitlab/config/gitlab.yml file). But then, it displays an error 500, with log message "error stack too deep".

I have then changed the file vendor/bundle/ruby/2.0.0/activesupport-3.2.13/lib/active_support/callbacks.rb to puts on a dummy file what is going on: (line 413)

def __reset_runner(symbol)
  f = File::open('/tmp/blah', 'a')
  f.write(caller(1,10))
  f.close()

I then see that it recurses on a few functions (functions calling each others in an infinite loop). (Here is a period in /home/git/gitlab; first line repeats after last one):

vendor/bundle/ruby/2.0.0/gems/activesupport-3.2.13/lib/active_support/callbacks.rb:436:in `block in __update_callbacks'
vendor/bundle/ruby/2.0.0/gems/activesupport-3.2.13/lib/active_support/callbacks.rb:433:in `each'
vendor/bundle/ruby/2.0.0/gems/activesupport-3.2.13/lib/active_support/callbacks.rb:433:in `__update_callbacks'
vendor/bundle/ruby/2.0.0/gems/activesupport-3.2.13/lib/active_support/callbacks.rb:502:in `set_callback'
vendor/bundle/ruby/2.0.0/gems/activemodel-3.2.13/lib/active_model/callbacks.rb:110:in `before_save'
vendor/bundle/ruby/2.0.0/gems/activerecord-3.2.13/lib/active_record/autosave_association.rb:189:in `add_autosave_association_callbacks'
vendor/bundle/ruby/2.0.0/gems/activerecord-3.2.13/lib/active_record/autosave_association.rb:140:in `build'
vendor/bundle/ruby/2.0.0/gems/activerecord-3.2.13/lib/active_record/associations/builder/has_many.rb:10:in `build'
vendor/bundle/ruby/2.0.0/gems/activerecord-3.2.13/lib/active_record/associations/builder/collection_association.rb:13:in `build'
vendor/bundle/ruby/2.0.0/gems/activerecord-3.2.13/lib/active_record/associations.rb:1198:in `has_many'

At this step, I really don't know how to fix this; it s far away from my RoR (none) and Ruby (few) knowledge. :/ Any help would be appreciated here!

I would like to use puppet to create mailboxes. Basically, I only need a directory to be created when a new user arrives. However, the users list is quite huge and creating a file stanza per user is out of question. I have found a way to pass an array with this stanza:

file { [ "user1", "user2", ... ]:
    ensure => directory,
    owner  => $user,
    group  => 'mail',
    mode   => 0660,
}

There are 2 problems with this: First, there is no way to retrieve the users list from an external resource (which could be a CSV file, for instance). And secondly, I can't see how it is possible to instantiate the owner value.

I have thought to define function, but the same problems remains. Has someone found a solution to solve this problem?

I am trying to manage Unix users with puppet. Puppet provides enough tools to create accounts and provide authorized_keys files for instance, but no to set up user password, and it tell to the user.

What I have done is a python script which generate a random password and send it to the user by email. The problem is, it is not possible to launch passwd Unix command with python, I have then written a bash script with the command:

echo -ne "$password\n$password\n" | passwd $user
passwd -e $user

Launched manually, the script works fine and the created user has its password sent by email. But when puppet launches it, only the python script gets executed, as if the os.system('/bin/bash my_bash_script') is ignored. No error is displayed. And the user gets its password, but the passwd commands are not launched.

Is there any limitation with puppet preventing to perform what I described? Or, how can I otherwise change the user account, its expiration, and send password by email?

I can provide more information, but right now, I don't know which are accurate.

Many thanks!

EDIT: Here is a basic code with same symptoms:

python: setuserpassword.py

#!/usr/bin/python
import os
import sys

user = sys.argv[1]
mail = sys.argv[2]
os.system('/bin/bash /root/tools/setuserpassword.sh '+user+' '+mail)

bash: setuserpassword.sh

#!/bin/bash
# Password setup for the account
password=`pwgen -N1 --secure 10`
echo -ne "$password\n$password\n" | passwd $USER > /dev/null 2>&1
[[ $? -ne 0 ]] && exit 2

# Setup the expirancy label to make sure user
# change its password upon fist success login
chage -d0 $USER

# Email sending to inform user of his new password
echo -ne "Hello, $USER;\n
The password is:\n
$password\n" | mail -s "$USER account created" $MAIL

Here is the module (no problem on this side)

define add_user ( $email, $uid, $gid ) { 

$username = $title

user { $username:
  comment => "$email",
  home    => "/home/$username",
  shell   => "/bin/bash",
  uid     => $uid,
  gid     => $gid,
}   

exec { "/root/tools/setuserpassword.py $username $email":
   path           => "/bin:/usr/bin:/usr/sbin/sbin",
   refreshonly    => true,
   subscribe      => user[$username],
   onlyif         => "cat /etc/shadow | grep $username | grep '!'",
   require        => Package['pwgen'],
}   

I'm trying to use puppet as a unix users management.

Here is the class I created to add new users:

class unix_accounts( $username, $forename, $name, $email, $uid) {

user { $username:
    comment => '$forename $name',
    home    => '/home/$username',
    shell   => '/bin/bash',
    uid     => $uid,
    groups  => [$username, 'sudo'],
}

I would like, as basically email and username ca be deduced from $name and $forename, to define these variables in the unix_accounts class. I have tried this:

$username = $forename[0].chr.downcase+name.downcase
$email    = $forename.downcase+'.'+$name.downcase+'@localnet.lan'

But puppetd test on client side fails out at the first dot (.) with the following message:

Error 400 on server: Syntax error at '.'; expected '}' at ....

This has nothing to do with ruby, because I have tried before with irb, it seems to be related to puppet syntax only. Is it possible anyway to created these variables inside a class? How to do that?

Many thanks

Is there any way to make sudo use the user's .bashrc file instead of the root one? I would like to use my own .bashrc while using sudo instead of the one of root or /etc/bashrc (I would have to force other users to use it).

The man page doesn't help much, but I'm sure there is a way to do so.

I am getting quite a weird trouble here with my puppet configuration.

On client and server (debian-squeeze), same version of puppet, clock synchronized.

Things were going great until I decided to install puppet-dashboard, I don't know at which step this lead to a failure, but here are the symptoms:

I have no certificate between the client and the server; I create on on client side which I send to server through this command:

puppetd --test --waitforcert 50

on the server side:

root@puppet:/var/lib/puppet/ssl# puppetca --list --all
  dev.goeland.lan (53:C8:AE:21:F0:64:FC:B8:7C:AD:7F:7A:1C:80:B0:4C)
root@puppet:/var/lib/puppet/ssl# puppetca -s dev.goeland.lan
notice: Signed certificate request for dev.goeland.lan
notice: Removing file Puppet::SSL::CertificateRequest dev.goeland.lan at '/var/lib/puppet/ssl/ca/requests/dev.goeland.lan.pem'
root@puppet:/var/lib/puppet/ssl# puppetca --list --all
+ dev.goeland.lan (FC:1A:E5:1F:D7:A3:C4:4A:B6:1A:7F:C6:4A:6E:07:55)
root@puppet:/var/lib/puppet/ssl#

First, I don't understand why the fingerprint changes : before being signed, the certificate is like *:4C, and it turns into *.55. Maybe this is a correct behavior?

Then, from client:

root@dev:/var/lib/puppet/ssl# puppetd --test 
warning: peer certificate won't be verified in this SSL session
info: Caching certificate for dev.goeland.lan
err: Could not retrieve catalog from remote server: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed
warning: Not using cache on failed catalog
err: Could not retrieve catalog; skipping run
root@dev:/var/lib/puppet/ssl#

Client refuses server certificate, while it has just been signed a the previous step!

Can anyone help me on this one?

Thanks a lot!

I'm trying to set up on a openldap server running on debian 6 the ssh authentication on a ldap-client host named ldap_client.

Here is what ldapsearch returns on server:

dn: dc=localnet,dc=lan
objectClass: dcObject
objectClass: organization
dc: localnet 
o: Some_Enterprise
description: localnet.lan

dn: ou=people,dc=localnet,dc=lan
objectClass: top
objectClass: organizationalUnit
ou: people

dn: ou=groups,dc=localnet,dc=lan
objectClass: top
objectClass: organizationalUnit
ou: groups

dn: uid=joe,ou=people,dc=localnet,dc=lan
objectClass: account
objectClass: posixAccount
cn: joe
uid: joe
uidNumber: 10001
gidNumber: 2000
homeDirectory: /home/joe
loginShell: /bin/sh
gecos: joe
description: joe

On the client side, I have configured libnss-ldap and nsswitch.conf as follow;

passwd:         files ldap
group:          files ldap
shadow:         files ldap

So that the unix command id on the client (id joe) returns its uid/gid. So the user is recognized by ldap.

But after hours goofing around google, I have not been able to set up the authentication on the client with ssh.

I have these lines at /etc/pam.d/commun-account, commun-auth and commun-password

auth        sufficient      pam_ldap.so
auth        required        pam_unix.so nullok_secure

And these on /etc/pam.d/ssh

auth    sufficient /lib/security/pam_ldap.so    no_warn
auth    required  pam_unix.so           no_warn try_first_pass
account required  /lib/security/pam_ldap.so no_warn ignore_authinfo_unavail ignore_unknown_user
account         required        pam_unix.so

I have the usePam=yes on /etc/ssh/sshd.conf.

Here are the output of auth.log on the client:

==> /var/log/auth.log <==
Dec  7 17:39:06 versionning sshd[3898]: pam_ldap: error trying to bind (Invalid credentials)
Dec  7 17:39:06 versionning sshd[3898]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=xxx.kimsufi.com  user=joe
Dec  7 17:39:08 versionning sshd[3898]: Failed password for joe from a.b.c.d port 58191 ssh2

On the server: ==> /var/log/syslog <== Dec 7 16:42:43 ldap slapd[963]: <= bdb_equality_candidates: (uid) not indexed

and with tshark

LDAP bindResponse(1) invalidCredentials    

I don't understand where and how I have to configure the joe's password. Not on the local unix account of the client, so on the server; I don't know where to do that

I am looking for a tool to monitor traffic on some ports of a CentOS server. On this server each service runs on a port from 3000 to 3050 and I would like to compare traffic consumption on these services; like which is the main talker/listener.

/proc/net/dev only give the global amount of bits send and received on the network interface, and not at port level.

Every tool I have found out goofing google provide report on interface level (such like eth0) and none at port level, but I may have not searched enough after all.

Do you guys know any way to do such thing?

I currently have troubles using snmpset to get the cisco configuration from a monitoring server.

Here is what I tip:

snmpset -v2c -cvtmYdXVHfo9v38oAbtACikvV calcium \
1.3.6.1.4.1.9.9.96.1.1.1.1.2.111 integer 1 \
1.3.6.1.4.1.9.9.96.1.1.1.1.3.111 integer 4 \ 
1.3.6.1.4.1.9.9.96.1.1.1.1.4.111 integer 1 \
1.3.6.1.4.1.9.9.96.1.1.1.1.5.111 ipaddress 172.23.129.4 \
1.3.6.1.4.1.9.9.96.1.1.1.1.6.111 octetstring "config" \
1.3.6.1.4.1.9.9.96.1.1.1.1.14.111 integer 4

Following the documentation available at cisco_snmp_doc:

ccCopyProtocol is 1.3.6.1.4.1.9.9.96.1.1.1.1.2
ccCopySourceFileType 1.3.6.1.4.1.9.9.96.1.1.1.1.3
ccCopyDestFileType 1.3.6.1.4.1.9.9.96.1.1.1.1.4
ccCopyServerAddress 1.3.6.1.4.1.9.9.96.1.1.1.1.5
ccCopyFileName 1.3.6.1.4.1.9.9.96.1.1.1.1.6
ccCopyEntryRowStatus 1.3.6.1.4.1.9.9.96.1.1.1.1.14

The Cisco documentation indicates to specify a random integer (here, 111, as it is in the documentation, but specifying 1 does not change anything)

Here is what I get:

1.3.6.1.4.1.9.9.96.1.1.1.1.5.111: Value out of range (172.23.129.4)
1.3.6.1.4.1.9.9.96.1.1.1.1.6.111: Unknown Object Identifier \
(Sub-id not found: (top) -> config)

Obviously, I can't set the ip address of my server to the related oid. Furthermore, I can't figure out what the second error means.

Can anyone give me some advice ? Any help or clue would be deeply appreciated

Thanks a lot :)